CVE-2026-123655
Description
A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This issue results in unauthorized information disclosure of protected content.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce authorization checks on H5P pluginfile URL requests before serving system-context content or files from hidden and unavailable course modules: upgrade to the fixed Moodle builds, which enforce source package access validation using can_access_content, block unauthenticated and guest users from system-context H5P files, restrict showdescription exemptions strictly to intro files, and verify export download settings, closing all 3 injection vectors (direct pluginfile URL requests for system-context H5P content, direct pluginfile URL requests for hidden or unavailable course module H5P files, direct pluginfile requests to download exported H5P packages when downloads are disabled). Until patched, this is a concern on Moodle instances hosting restricted, system-context, or hidden course module H5P content files, so Restrict network access to Moodle instances or avoid storing sensitive, unreleased, or hidden H5P content files on the server. As a compensating measure, Deny unauthenticated access by requiring explicit authorization validation before dispatching requests to content-serving handlers. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing authorization defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-909 Default-Deny API Authorization Policy (medium)
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data; Read Files or Directories
An attacker could read sensitive data, either by reading the data directly from a data store that is not restricted, or by accessing insufficiently-protected, privileged functionality to read the data.
Integrity
Technical Impact: Modify Application Data; Modify Files or Directories
An attacker could modify sensitive data, either by writing the data directly to a data store that is not restricted, or by accessing insufficiently-protected, privileged functionality to write the data.
Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
An attacker could gain privileges by modifying or reading critical data directly, or by accessing privileged functionality.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
An attacker could gain unauthorized access to resources on the system and excessively consume those resources, leading to a denial of service.
Acknowledgements
Upstream acknowledges Jari Vilkman as the original reporter.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
